The EBA's Outsourcing Guidelines address how firms govern external service arrangements. Criticality assessment, due diligence and contractual rights connect monitoring with concentration-risk and exit planning, supported by outsourcing registers and regulatory notifications.
TL;DR:
- Outsourcing requires criticality assessment, due diligence, contracts, monitoring and exit planning.
- Access, audit rights and records support oversight; institutional responsibility remains.
- 2026 successor guidelines repeal these only when applicable; DORA separately covers ICT risk.
Summary
Identifying outsourcing and important functions
EBA/GL/2019/02 establishes a harmonised supervisory framework for outsourcing by institutions within its scope, including relevant payment and electronic-money institutions. It defines outsourcing and the criteria for assessing whether a function is critical or important. The assessment concerns how disruption or poor performance would affect the institution, rather than treating every ordinary purchase from a supplier as an identical outsourcing arrangement.
Governance, due diligence and retained responsibility
The guidelines address the institution's outsourcing policy, decision-making and risk assessment, including provider due diligence and concentration risks. A record of arrangements supports oversight of dependencies across the business. Using an external company does not transfer the institution's regulatory responsibility for the function. Its own governance and resources must remain capable of managing the arrangement and understanding the risks created by the service and its subcontracting chain.
Contracts, monitoring and a workable exit
Written agreements for critical or important functions should allocate responsibilities and address service levels, locations, reporting, data protection and relevant access and audit rights. Ongoing monitoring and exit planning connect the contract to the institution's ability to continue or replace the service. An exit plan therefore needs to consider the function, data and alternative arrangements, rather than merely the formal right to terminate a supplier contract.
DORA and the September 2026 successor
DORA supplies a distinct framework for ICT third-party arrangements. The EBA published final successor guidelines on third-party risk in September 2026, with an implementation transition described in its announcement. Its official status page states that the outsourcing guidelines will be repealed once the successor becomes applicable. The two publications should therefore be distinguished by their scope and application status; a final successor publication is not evidence that the 2019 framework disappeared immediately.
Keywords
- EBA outsourcing
- critical functions
- due diligence
- written contracts
- audit rights
- exit planning
- supplier monitoring
- institutional responsibility
- DORA
- successor guidelines